You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Since the current version of PulledPork now copies rules from local_rules to rule_path, it looks like if you set an ips_policy to apply to your Snort ruleset, it will try to apply that policy to your local_rules as well. Since most local rules don't have any policy set, they are therefore disabled. For example, please see: https://groups.google.com/d/topic/security-onion/D9BW2ttPF3Y/discussion
Is this intended behavior?
The text was updated successfully, but these errors were encountered:
In the case you referenced, I would assume this is not intended behavior, because the engine is Suricata and not Snort, but still seems like worth investigating even for Suricata.
But having the ability to have policy in your local.rules outside of the official Talos rules for Snort sounds like something you would want, I will take a look and let you know.
Hello!
This question is related to #235.
Since the current version of PulledPork now copies rules from local_rules to rule_path, it looks like if you set an ips_policy to apply to your Snort ruleset, it will try to apply that policy to your local_rules as well. Since most local rules don't have any policy set, they are therefore disabled. For example, please see:
https://groups.google.com/d/topic/security-onion/D9BW2ttPF3Y/discussion
Is this intended behavior?
The text was updated successfully, but these errors were encountered: